| Age | Commit message (Collapse) | Author |
|---|
|
This patch allows booting Kirkwood with the L2 in writeback mode,
by reading the WT override bit from the L2 config register and
passing that into the Feroceon L2 init routine, instead of assuming
that the WT override bit will always be set
Signed-off-by: Saeed Bishara <saeed@marvell.com>
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
|
|
The Marvell Discovery Duo (MV78xx0) is a family of ARM SoCs featuring
(depending on the model) one or two Feroceon CPU cores with 512K of L2
cache and VFP coprocessors running at (depending on the model) between
800 MHz and 1.2 GHz, and features a DDR2 controller, two PCIe
interfaces that can each run either in x4 or quad x1 mode, three USB
2.0 interfaces, two 3Gb/s SATA II interfaces, a SPI interface, two
TWSI interfaces, a crypto accelerator, IDMA/XOR engines, a SPI
interface, four UARTs, and depending on the model, two or four gigabit
ethernet interfaces.
This patch adds basic support for the platform, and allows booting
on the MV78x00 development board, with functional UARTs, SATA, PCIe,
GigE and USB ports.
Signed-off-by: Stanislav Samsonov <samsonov@marvell.com>
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
|
|
The Discovery Duo (MV78xx0) has two x4 PCIe ports which can either
be used in x4 mode or in quad x1 mode. This patch adds an accessor
function to the generic plat-orion PCIe handling code to detect in
which of the two modes we're running (which is determined by strap
pins and/or configured by the bootloader).
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
|
|
The Marvell Kirkwood (88F6000) is a family of ARM SoCs based on a
Shiva CPU core, and features a DDR2 controller, a x1 PCIe interface,
a USB 2.0 interface, a SPI controller, a crypto accelerator, a TS
interface, and IDMA/XOR engines, and depending on the model, also
features one or two Gigabit Ethernet interfaces, two SATA II
interfaces, one or two TWSI interfaces, one or two UARTs, a
TDM/SLIC interface, a NAND controller, an I2S/SPDIF interface, and
an SDIO interface.
This patch adds supports for the Marvell DB-88F6281-BP Development
Board and the RD-88F6192-NAS and the RD-88F6281 Reference Designs,
enabling support for the PCIe interface, the USB interface, the
ethernet interfaces, the SATA interfaces, the TWSI interfaces, the
UARTs, and the NAND controller.
Signed-off-by: Saeed Bishara <saeed@marvell.com>
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
|
|
This patch adds support for the unified Feroceon L2 cache controller
as found in e.g. the Marvell Kirkwood and Marvell Discovery Duo
families of ARM SoCs.
Note that:
- Page table walks are outer uncacheable on Kirkwood and Discovery
Duo, since the ARMv5 spec provides no way to indicate outer
cacheability of page table walks (specifying it in TTBR[4:3] is
an ARMv6+ feature).
This requires adding L2 cache clean instructions to
proc-feroceon.S (dcache_clean_area(), set_pte()) as well as to
tlbflush.h ({flush,clean}_pmd_entry()). The latter case is handled
by defining a new TLB type (TLB_FEROCEON) which is almost identical
to the v4wbi one but provides a TLB_L2CLEAN_FR flag.
- The Feroceon L2 cache controller supports L2 range (i.e. 'clean L2
range by MVA' and 'invalidate L2 range by MVA') operations, and this
patch uses those range operations for all Linux outer cache
operations, as they are faster than the regular per-line operations.
L2 range operations are not interruptible on this hardware, which
avoids potential livelock issues, but can be bad for interrupt
latency, so there is a compile-time tunable (MAX_RANGE_SIZE) which
allows you to select the maximum range size to operate on at once.
(Valid range is between one cache line and one 4KiB page, and must
be a multiple of the line size.)
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
|
|
This patch adds support for the L1 D cache range operations that
are supported by the Marvell Discovery Duo and Marvell Kirkwood
ARM SoCs.
Signed-off-by: Stanislav Samsonov <samsonov@marvell.com>
Acked-by: Saeed Bishara <saeed@marvell.com>
Reviewed-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
|
|
The Marvell Loki (88RC8480) is an ARM SoC based on a Feroceon CPU
core running at between 400 MHz and 1.0 GHz, and features a 64 bit
DDR controller, 512K of internal SRAM, two x4 PCI-Express ports,
two Gigabit Ethernet ports, two 4x SAS/SATA controllers, two UARTs,
two TWSI controllers, and IDMA/XOR engines.
This patch adds support for the Marvell LB88RC8480 Development
Board, enabling the use of the PCIe interfaces, the ethernet
interfaces, the TWSI interfaces and the UARTs.
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
|
|
Some Feroceon-based SoCs have an MBUS bridge interrupt controller
that requires writing a one instead of a zero to clear edge
interrupt sources such as timer expiry.
This patch adds a new BRIDGE_INT_TIMER1_CLR define, which platform
code can set to either ~BRIDGE_INT_TIMER1 (write-zero-to-clear) or
BRIDGE_INT_TIMER1 (write-one-to-clear) depending on the platform.
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
|
|
Nuke the Orion-specific orion5x_{read,write} wrappers.
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
|
|
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
|
|
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Acked-by: Russell King <linux@arm.linux.org.uk>
|
|
This define isn't used anywhere in the kernel tree -- nuke it.
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Acked-by: Russell King <linux@arm.linux.org.uk>
|
|
The implementation for memory copy functions on ARM had a (disabled)
provision for aligning the source pointer before loading registers with
data. Turns out that aligning the _destination_ pointer is much more
useful, as the read side is already sufficiently helped with the use of
preload.
So this changes the definition of the CALGN() macro to target the
destination pointer instead, and turns it on for Feroceon processors
where the gain is very noticeable.
Signed-off-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
x86, geode: add a VSA2 ID for General Software
x86: use BOOTMEM_EXCLUSIVE on 32-bit
x86, 32-bit: fix boot failure on TSC-less processors
x86: fix NULL pointer deref in __switch_to
x86: set PAE PHYSICAL_MASK_SHIFT to 44 bits.
|
|
General Software writes their own VSA2 module for their version
of the Geode BIOS, which returns a different ID then the standard
VSA2. This was causing the framebuffer driver to break for most
GSW boards.
Signed-off-by: Jordan Crouse <jordan.crouse@amd.com>
Cc: tglx@linutronix.de
Cc: linux-geode@lists.infradead.org
Signed-off-by: Ingo Molnar <mingo@elte.hu>
|
|
This allows other threads to run when the serial driver polls the CTS
PIN in a loop.
Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
Signed-off-by: Bryan Wu <cooloney@kernel.org>
|
|
Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
Signed-off-by: Bryan Wu <cooloney@kernel.org>
|
|
When a 64-bit x86 processor runs in 32-bit PAE mode, a pte can
potentially have the same number of physical address bits as the
64-bit host ("Enhanced Legacy PAE Paging"). This means, in theory,
we could have up to 52 bits of physical address in a pte.
The 32-bit kernel uses a 32-bit unsigned long to represent a pfn.
This means that it can only represent physical addresses up to 32+12=44
bits wide. Rather than widening pfns everywhere, just set 2^44 as the
Linux x86_32-PAE architectural limit for physical address size.
This is a bugfix for two cases:
1. running a 32-bit PAE kernel on a machine with
more than 64GB RAM.
2. running a 32-bit PAE Xen guest on a host machine with
more than 64GB RAM
In both cases, a pte could need to have more than 36 bits of physical,
and masking it to 36-bits will cause fairly severe havoc.
Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Cc: Jan Beulich <jbeulich@novell.com>
Cc: <stable@kernel.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/airlied/agp-2.6
* 'agp-patches' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/agp-2.6:
agp/intel: cleanup some serious whitespace badness
[AGP] intel_agp: Add support for Intel 4 series chipsets
[AGP] intel_agp: extra stolen mem size available for IGD_GM chipset
agp: more boolean conversions.
drivers/char/agp - use bool
agp: two-stage page destruction issue
agp/via: fixup pci ids
|
|
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Use boolean in AGP instead of having own TRUE/FALSE
--
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (43 commits)
netlink: genl: fix circular locking
Revert "mac80211: Use skb_header_cloned() on TX path."
af_unix: fix 'poll for write'/ connected DGRAM sockets
tun: Proper handling of IPv6 header in tun driver when TUN_NO_PI is set
atl1: relax eeprom mac address error check
net/enc28j60: low power mode
net/enc28j60: section fix
sky2: 88E8040T pci device id
netxen: download firmware in pci probe
netxen: cleanup debug messages
netxen: remove global physical_port array
netxen: fix portnum for hp mezz cards
ibm_newemac: select CRC32 in Kconfig
xfrm: fix fragmentation for ipv4 xfrm tunnel
netfilter: nf_conntrack_h323: fix module unload crash
netfilter: nf_conntrack_h323: fix memory leak in module initialization error path
netfilter: nf_nat: fix RCU races
atm: [he] send idle cells instead of unassigned when in SDH mode
atm: [he] limit queries to the device's register space
atm: [br2864] fix routed vcmux support
...
|
|
Fix three ct_extend/NAT extension related races:
- When cleaning up the extension area and removing it from the bysource hash,
the nat->ct pointer must not be set to NULL since it may still be used in
a RCU read side
- When replacing a NAT extension area in the bysource hash, the nat->ct
pointer must be assigned before performing the replacement
- When reallocating extension storage in ct_extend, the old memory must
not be freed immediately since it may still be used by a RCU read side
Possibly fixes https://bugzilla.redhat.com/show_bug.cgi?id=449315
and/or http://bugzilla.kernel.org/show_bug.cgi?id=10875
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
We've introduced extra need of compat layer for ip_tunnel_prl{}
for PRL (Potential Router List) management. Though compat_ioctl
is still missing in ipv4/ipv6, let's make the interface more
straight-forward and eliminate extra need for nasty compat layer
anyway since the interface is new for 2.6.26.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6
* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
[IA64] Fix CONFIG_IA64_SGI_UV build error
[IA64] Update check_sal_cache_flush to use platform_send_ipi()
[IA64] perfmon: fix async exit bug
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc: (21 commits)
[POWERPC] Turn on ATA_SFF so we get SATA_SVW back in defconfigs
[POWERPC] Remove ppc32's export of console_drivers
[POWERPC] Fix -Os kernel builds with newer gcc versions
[POWERPC] Fix bootwrapper builds with newer gcc versions
[POWERPC] Build fix for drivers/macintosh/mediabay.c
[POWERPC] Fix warning in pseries/eeh_driver.c
[POWERPC] Add missing of_node_put in drivers/macintosh/therm_adt746x.c
[POWERPC] Add missing of_node_put in drivers/macintosh/smu.c
[POWERPC] Add missing of_node_put in pseries/nvram.c
[POWERPC] Fix return value check logic in debugfs virq_mapping setup
[POWERPC] Fix rmb to order cacheable vs. noncacheable
powerpc/spufs: fix missed stop-and-signal event
powerpc/spufs: synchronize interaction between spu exception handling and time slicing
powerpc/spufs: remove class_0_dsisr from spu exception handling
powerpc/spufs: wait for stable spu status in spu_stopped()
[POWERPC] bootwrapper: add simpleImage* to list of boot targets
[POWERPC] 83xx: MPC837xRDB's VSC7385 ethernet switch isn't on the MDIO bus
[POWERPC] Updated Freescale PPC defconfigs
[POWERPC] 8610: Update defconfig for MPC8610 HPCD
[POWERPC] 85xx: MPC8548CDS - Fix size of PCIe IO space
...
|
|
* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
[MIPS] Au1200: MMC resource size off by one
[MIPS] TANBAC: Update defconfig
[MIPS] Vr41xx: Initialize PCI io_map_base
[MIPS] Malta: Always compile MTD platform device registration code.
[MIPS] Malta: Fix build errors for 64-bit kernels
[MIPS] Lasat: sysctl fixup
[MIPS] Fix buggy use of kmap_coherent.
[MIPS] Lasat: bring back from the dead
[MIPS] vpe_id is required for VSMP and SMTC builds
[MIPS] Export smp_call_function and smp_call_function_single.
[MIPS] Bring the SWARM defconfig up to date
[MIPS] Sibyte: Build RTC support as an object
[MIPS] Fix the fix for divide by zero error in build_{clear,copy}_page
[MIPS] Fix build for PNX platforms.
[MIPS] Add RM200 with R5000 CPU to known ARC machines
[MIPS] Better load address for big endian SNI RM
[MIPS] SB1250: Initialize io_map_base
[MIPS] Alchemy: Add au1500 reserved interrupt
[MIPS] Export empty_zero_page for sake of the ext4 module.
|
|
This seems to have been removed accidentally in commit
ed7b1889da256977574663689b598d88950bbd23 ("Unexport asm/page.h"), but
wasn't supposed to have been -- the original patch at
http://lkml.org/lkml/2007/10/30/144 just moved it from $(header-y) to
$(unifdef-y)
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: Peter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
This file is only included where it makes sense now, so there's no need
for the CONFIG_ARCH_SUPPORTS_AOUT conditional -- and that conditional is
bad, because we want to export <linux/a.out.h> to userspace.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: Peter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Fix build error in CONFIG_IA64_SGI_UV config. (GENERIC builds
are ok).
Signed-off-by: Jack Steiner <steiner@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
|
|
Fix 64-bit Malta by using CKSEG0ADDR and correct casts.
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
|
|
After the common MIPS CPU interrupt controller (for irq0-7) was introduced
the Lasat boards didn't get their interrupts right, so nothing worked. The
old routines need to be offset by the new 8 hardware interrupts common to
all MIPS CPU's.
Signed-off-by: Thomas Horsten <thomas@horsten.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
|
|
Signed-off-by: Chris Dearman <chris@mips.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
|
|
Build error was caused by commit 351336929ccf222ae38ff0cb7a8dd5fd5c6236a0.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
|
|
In the conversion done in the commits
95c4eb3ef4484ca85da5c98780d358cffd546b90
9d360ab4a7568a8d177280f651a8a772ae52b9b9
[MIPS] Alchemy: Renumber interrupts so irq_cpu can work.
one reserved interrupt on au1500 was missed. this broke the au1000 ethernet
driver.
Signed-off-by: Bruno Randolf <br1@einfach.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
|
|
This fixes the following build error with CONFIG_BLK_DEV_IDE_PMAC=n:
<-- snip -->
...
CC drivers/macintosh/mediabay.o
/home/bunk/linux/kernel-2.6/git/linux-2.6/drivers/macintosh/mediabay.c: In function 'check_media_bay':
/home/bunk/linux/kernel-2.6/git/linux-2.6/drivers/macintosh/mediabay.c:428: error: 'struct media_bay_info' has no member named 'cd_index'
make[3]: *** [drivers/macintosh/mediabay.o] Error 1
<-- snip -->
Reported-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>
|
|
lwsync is explicitly defined not to have any effect on the ordering of
accesses to device memory, so it cannot be used for rmb(). sync appears
to be the only barrier which fits the bill.
Signed-off-by: Nick Piggin <npiggin@suse.de>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>
|
|
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jk/spufs into merge
|
|
According to the CBEA, the SPU dsisr is not updated for class 0
exceptions.
spu_stopped() is testing the dsisr that was passed to it from the class
0 exception handler, so we return a false positive here.
This patch cleans up the interrupt handler and erroneous tests in
spu_stopped. It also removes the fields from the csa since it is not
needed to process class 0 events.
Signed-off-by: Luke Browning <lukebrowning@us.ibm.com>
Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
PCI: fixup write combine comment in pci_mmap_resource
x86: PAT export resource_wc in pci sysfs
x86, pci-dma.c: don't always add __GFP_NORETRY to gfp
suspend-vs-iommu: prevent suspend if we could not resume
x86: pci-dma.c: use __GFP_NO_OOM instead of __GFP_NORETRY
pci, x86: add workaround for bug in ASUS A7V600 BIOS (rev 1005)
PCI: use dev_to_node in pci_call_probe
PCI: Correct last two HP entries in the bfsort whitelist
|
|
* git://git.kernel.org/pub/scm/linux/kernel/git/kyle/parisc-2.6:
parisc: update my email address
parisc: fix miscompilation of ip_fast_csum with gcc >= 4.3
parisc: fix off by one in setup_sigcontext32
parisc: export empty_zero_page
parisc: export copy_user_page_asm
parisc: move head.S to head.text section
Revert "parisc: fix trivial section name warnings"
|
|
ip_fast_csum needs an asm "memory" clobber, otherwise the aggressive
optimizations in gcc-4.3 cause it to be miscompiled.
Signed-off-by: Kyle McMartin <kyle@mcmartin.ca>
|
|
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
tcp: Revert 'process defer accept as established' changes.
ipv6: Fix duplicate initialization of rawv6_prot.destroy
bnx2x: Updating the Maintainer
net: Eliminate flush_scheduled_work() calls while RTNL is held.
drivers/net/r6040.c: correct bad use of round_jiffies()
fec_mpc52xx: MPC52xx_MESSAGES_DEFAULT: 2nd NETIF_MSG_IFDOWN => IFUP
ipg: fix receivemode IPG_RM_RECEIVEMULTICAST{,HASH} in ipg_nic_set_multicast_list()
netfilter: nf_conntrack: fix ctnetlink related crash in nf_nat_setup_info()
netfilter: Make nflog quiet when no one listen in userspace.
ipv6: Fail with appropriate error code when setting not-applicable sockopt.
ipv6: Check IPV6_MULTICAST_LOOP option value.
ipv6: Check the hop limit setting in ancillary data.
ipv6 route: Fix route lifetime in netlink message.
ipv6 mcast: Check address family of gf_group in getsockopt(MS_FILTER).
dccp: Bug in initial acknowledgment number assignment
dccp ccid-3: X truncated due to type conversion
dccp ccid-3: TFRC reverse-lookup Bug-Fix
dccp ccid-2: Bug-Fix - Ack Vectors need to be ignored on request sockets
dccp: Fix sparse warnings
dccp ccid-3: Bug-Fix - Zero RTT is possible
|
|
* master.kernel.org:/home/rmk/linux-2.6-arm:
[ARM] 5091/1: Add missing bitfield include to regs-lcd.h
[ARM] 5090/1: Correct pxafb palette typo error
[ARM] 5077/1: spi: fix list scan success verification in PXA ssp driver
|
|
We need this at least for huge page detection for now, because powerpc
needs the vm_area_struct to be able to determine whether a virtual address
is referring to a huge page (its pmd_huge() doesn't work).
It might also come in handy for some of the other users.
Signed-off-by: Dave Hansen <dave@linux.vnet.ibm.com>
Acked-by: Matt Mackall <mpm@selenic.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Add support for the next generation of HP Smart Array SAS/SATA
controllers. Shipping date is late Fall 2008.
Bump the driver version to 3.6.20 to reflect the new hardware support from
patch 1 of this set.
Signed-off-by: Mike Miller <mike.miller@hp.com>
Cc: Jens Axboe <jens.axboe@oracle.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Move the forward-declaration of struct mm_struct a little way up
proc_fs.h. This fixes a bunch of "'struct mm_struct' declared inside
parameter list" warnings with CONFIG_PROC_FS=n
Signed-off-by: Ben Nizette <bn@niasdigital.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Add ext2_find_{first,next}_bit(), which are needed for ext4. They're
derived out of the ext2_find_next_zero_bit found in the same file.
Compile tested with crosstools
[Reworked to preserve all symmetry with ext2_find_{first,next}_zero_bit()]
This fixes http://bugzilla.kernel.org/show_bug.cgi?id=10393
[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
This reverts two changesets, ec3c0982a2dd1e671bad8e9d26c28dcba0039d87
("[TCP]: TCP_DEFER_ACCEPT updates - process as established") and
the follow-on bug fix 9ae27e0adbf471c7a6b80102e38e1d5a346b3b38
("tcp: Fix slab corruption with ipv6 and tcp6fuzz").
This change causes several problems, first reported by Ingo Molnar
as a distcc-over-loopback regression where connections were getting
stuck.
Ilpo Järvinen first spotted the locking problems. The new function
added by this code, tcp_defer_accept_check(), only has the
child socket locked, yet it is modifying state of the parent
listening socket.
Fixing that is non-trivial at best, because we can't simply just grab
the parent listening socket lock at this point, because it would
create an ABBA deadlock. The normal ordering is parent listening
socket --> child socket, but this code path would require the
reverse lock ordering.
Next is a problem noticed by Vitaliy Gusev, he noted:
----------------------------------------
>--- a/net/ipv4/tcp_timer.c
>+++ b/net/ipv4/tcp_timer.c
>@@ -481,6 +481,11 @@ static void tcp_keepalive_timer (unsigned long data)
> goto death;
> }
>
>+ if (tp->defer_tcp_accept.request && sk->sk_state == TCP_ESTABLISHED) {
>+ tcp_send_active_reset(sk, GFP_ATOMIC);
>+ goto death;
Here socket sk is not attached to listening socket's request queue. tcp_done()
will not call inet_csk_destroy_sock() (and tcp_v4_destroy_sock() which should
release this sk) as socket is not DEAD. Therefore socket sk will be lost for
freeing.
----------------------------------------
Finally, Alexey Kuznetsov argues that there might not even be any
real value or advantage to these new semantics even if we fix all
of the bugs:
----------------------------------------
Hiding from accept() sockets with only out-of-order data only
is the only thing which is impossible with old approach. Is this really
so valuable? My opinion: no, this is nothing but a new loophole
to consume memory without control.
----------------------------------------
So revert this thing for now.
Signed-off-by: David S. Miller <davem@davemloft.net>
|
